Cloud Security Fundamentals

Learning Path

📘 Phase 1 – Overview

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand what cloud security is.
Explain the objectives of cloud security.
Identify the major cloud security domains.
Understand common cloud threats.
Recognise security controls used in AWS.
Understand the role of a Cloud Security Engineer.

📚 Lesson Information

Estimated Time: 90 Minutes

Difficulty: Beginner

Prerequisites: Cloud Computing Fundamentals

Hands-on Lab: Yes

Assignment: Yes

💼 Business Value

Moving to the cloud provides flexibility and scalability, but it also introduces new security risks.

A single misconfiguration can expose customer data, disrupt business operations, damage reputation, and lead to regulatory penalties.

Cloud Security Engineers help organisations protect their cloud environments while enabling innovation and business growth.

🌍 What is Cloud Security?

Cloud security is the practice of protecting cloud infrastructure, applications, data, identities, and workloads from cyber threats.

Cloud security combines:

People
Processes
Technology
Governance

Its goal is to ensure cloud resources remain:

Secure
Available
Compliant
Resilient

🎯 Objectives of Cloud Security

Cloud security aims to:

Protect sensitive information.
Prevent unauthorised access.
Detect malicious activity.
Respond to security incidents.
Maintain business continuity.
Meet regulatory compliance requirements.
Build customer trust.

🏢 What Needs Protection?

A Cloud Security Engineer protects much more than servers.

Key assets include:

Cloud accounts
IAM users and roles
Applications
APIs
Virtual machines
Containers
Storage
Databases
Secrets
Encryption keys
Logs
Customer data
Backups
Network infrastructure

Every asset has value to the organisation.

🧱 The Six Pillars of Cloud Security

1. Identity Security

Protect identities and control access.

Examples:

IAM
MFA
Roles
Federation
Single Sign-On

2. Network Security

Protect communication between systems.

Examples:

VPC
Security Groups
Network ACLs
AWS WAF
AWS Shield
VPN

3. Data Security

Protect sensitive information.

Examples:

Encryption
AWS KMS
S3 Bucket Policies
Backup
Versioning

4. Infrastructure Security

Protect cloud resources.

Examples:

EC2
Containers
Operating Systems
Patch Management
Hardened Images

5. Monitoring & Detection

Continuously detect suspicious behaviour.

Examples:

CloudTrail
CloudWatch
GuardDuty
Security Hub
Amazon Inspector

6. Governance & Compliance

Ensure cloud environments meet organisational policies.

Examples:

AWS Config
Audit Manager
IAM Policies
Compliance Standards
Security Baselines

⚠️ Common Cloud Threats

Cloud attacks rarely begin with sophisticated exploits.

Most incidents occur because of configuration mistakes.

Common threats include:

Public storage buckets
Weak passwords
Missing MFA
Excessive IAM permissions
Stolen API keys
Unpatched servers
Phishing attacks
Insider threats
Ransomware
Credential theft

🛡️ Security Controls

Security controls reduce risk.

Examples include:

Preventive Controls

Prevent attacks before they happen.

Examples:

MFA
Encryption
Least Privilege
Security Groups

Detective Controls

Identify suspicious behaviour.

Examples:

CloudTrail
GuardDuty
CloudWatch
Security Hub

Corrective Controls

Recover after an incident.

Examples:

Automated remediation
Backups
Incident Response
Disaster Recovery

🏗️ Defence in Layers

Enterprise cloud security uses multiple layers.

Users
   │
   ▼
Identity Security
   │
   ▼
Network Security
   │
   ▼
Application Security
   │
   ▼
Operating System Security
   │
   ▼
Data Protection
   │
   ▼
Logging & Monitoring
   │
   ▼
Incident Response

No single security control is sufficient.

👨‍💻 Role of a Cloud Security Engineer

Typical responsibilities include:

Reviewing IAM permissions.
Designing secure cloud architectures.
Monitoring security alerts.
Responding to incidents.
Investigating suspicious activity.
Performing risk assessments.
Supporting compliance initiatives.
Working with development teams.
Conducting security reviews.

Security Engineers balance protection with business requirements.

🏢 Enterprise Scenario

CloudNova Technologies

CloudNova Technologies has migrated its customer portal to AWS.

During a routine review, you identify:

An S3 bucket is publicly accessible.
EC2 instances are missing security updates.
IAM users have AdministratorAccess.
CloudTrail logging is disabled.
Database backups are not encrypted.

As the Cloud Security Engineer:

Identify each security issue.
Explain the business impact.
Recommend security controls.
Prioritise the remediation tasks.

🧪 Hands-on Exercise 1 — Review AWS Security Services

Visit:

https://aws.amazon.com/products/security/

Explore:

IAM
GuardDuty
Security Hub
Inspector
AWS Config
AWS WAF
Shield
KMS

Answer:

What problem does each service solve?
Which services are preventive?
Which services are detective?

🧪 Hands-on Exercise 2 — Explore the AWS Shared Responsibility Model

Visit:

https://aws.amazon.com/compliance/shared-responsibility-model/

Create a table with:

AWS Responsibility	Customer Responsibility
Physical security	IAM users
Hardware	Data
Global infrastructure	Applications
Networking	Operating systems

This prepares you for the next lesson.

🧪 Hands-on Exercise 3 — Identify Cloud Assets

Imagine CloudNova Technologies hosts an online banking application.

List all cloud assets that require protection, including:

Users
Applications
Servers
Databases
APIs
Storage
Secrets
Logs
Encryption Keys

Discuss why each asset is valuable to attackers.

🧪 Hands-on Exercise 4 — Enable MFA on AWS

If you have not already:

Sign in to the AWS Management Console.
Navigate to IAM.
Select your user account.
Open the Security credentials tab.
Configure Multi-Factor Authentication (MFA).
Verify successful sign-in using MFA.

Discuss:

Why is MFA one of the simplest yet most effective security controls?
What risks remain if MFA is not enabled?

🧪 Hands-on Exercise 5 — Review Security Headers

Inspect a secure website:

curl -I https://aws.amazon.com

Look for:

Strict-Transport-Security
X-Content-Type-Options
Content-Security-Policy
X-Frame-Options

Questions:

Which headers help prevent attacks?
Why are these headers important for web application security?

📊 Knowledge Check

Answer the following:

What is cloud security?
Why is identity considered the new security perimeter?
Name the six pillars of cloud security.
Give three examples of preventive controls.
Give three examples of detective controls.
What is the purpose of encryption?
Why is logging critical in cloud environments?

📝 Assignment

CloudNova Technologies is launching a new customer-facing application on AWS.

Prepare a Cloud Security Readiness Report (2–3 pages) covering:

Assets requiring protection.
Potential threats.
Recommended security controls.
Preventive, detective, and corrective controls.
Business risks if controls are not implemented.
Recommendations for improving the security posture.

💡 Key Takeaways

After completing this lesson, you should understand:

Cloud security protects much more than servers.
Every cloud asset has business value.
Security is built using layered controls.
Identity, network, data, infrastructure, monitoring, and governance work together.
Cloud Security Engineers help organisations reduce risk while enabling business growth.

📚 Further Reading

AWS Security Best Practices
AWS Well-Architected Framework – Security Pillar
CIS AWS Foundations Benchmark
NIST Cybersecurity Framework
OWASP Top 10

🚀 Next Lesson

➡️ Shared Responsibility Model